---
name: a-successful-child-swallows-its-own-instrument
description: A test harness that pipes a child process's stderr prints it only on assertion failure, so an instrument on the SUCCESS path returns empty — and empty reads as "the site never fired".
metadata:
  type: feedback
---

Instrumenting a child process through `stderr` is invisible wherever the harness CAPTURES that
stderr and renders it only in a failure message. The success path — usually the exact path under
investigation — silently discards every line.

Measured 2026-08-29, CONDUIT #236 respin RCA. I put four `eprintln`-class probes into the sink, both
publish sites and the identity resolver, ran the failing cells, and got back **one** line out of
four sites. The rig's `send_bounded` pipes the child's stdout/stderr and the cell only surfaces them
inside an `assert!` message when the send FAILS; the send succeeded, so the send-site and sink probes
died with the pipe. The single survivor came from an unrelated place — the reap helper happens to
`eprintln!` the daemon-stop child's captured stderr, which smuggled one probe line out.

The dangerous part is the shape of the miss: three empty sites read as "those sites never fired",
which is a substantive (and wrong) finding about the mechanism, not an obviously broken instrument.

**How to apply:** for any probe that must survive a PASSING run, write to a FILE, not to a stream a
parent may capture — an append-mode `OpenOptions` write to a path from an env var (default to a fixed
temp path) costs three lines and is immune to capture, `--no-capture` flags, fail-fast, and pipe
ownership. Compose the whole line and emit it in ONE `write_all` so two processes sharing the sink
cannot interleave the token ([[single-write-token-emission]]). Then read the file, not the transcript.

Related: [[instrument-output-must-outlive-its-subject]] (same family, different killer — there the
sink lived inside a tree the subject deleted), [[exit-status-is-not-a-diagnosis-capture-the-child]].